Slideshare uses cookies to improve functionality and performance, and to provide you with relevant advertising. If you continue browsing the site, you agree to the use of cookies on this website. See our User Agreement and Privacy Policy.

Slideshare uses cookies to improve functionality and performance, and to provide you with relevant advertising. If you continue browsing the site, you agree to the use of cookies on this website. See our Privacy Policy and User Agreement for details.

PhishAri: Automatic Realtime Phishing Detection on Twitter

With the advent of online social media, phishers have started using social networks like Twitter, Facebook, Foursquare to spread phishing scams. Twitter is an immensely popular micro-blogging network where people post short messages of 140 characters called tweets. It has over 100 million active users who post about 200 million tweets everyday. Because of this vast information dissemination, phishers have started using Twitter as a medium to spread phishing. It is also difficult to detect phishing on Twitter unlike emails because of the quick spread of phishing links in the network, short size of the content, and use of URL obfuscation to shorten the URL to meet the requirement of 140 character tweet limit. Our technique, PhishAri, detects phishing on Twitter in realtime. We use Twitter specific features along with URL features to detect whether a tweet posted with a URL is phishing or not. Some of the Twitter specific features we use are tweet content and its characteristics like length, hashtags and mentions. Other Twitter features used are the characteristics of the Twitter user posting the tweet such as age of the account, number of tweets and the follower-followee ratio. These twitter specific features coupled with URL based features prove to be a strong mechanism to detect phishing tweets. We use machine learning classification techniques and detect phishing tweets with an accuracy of 92.52%. We have deployed our system for end-users by providing an easy to use Chrome browser extension. The extension works in realtime and classifies a tweet as phishing or safe when it appears in Twitter timeline of a user. In this research, we show that we are able to detect phishing tweets at zero hour with high accuracy which is much faster than public blacklists and as well as Twitter's own defense mechanism to detect malicious content. We also performed a quick user evaluation of PhishAri in a laboratory study to show that users like and are happy to use PhishAri in real-world. To the best of our knowledge, this is the first realtime, comprehensive, and usable system to detect phishing on Twitter.

PhishAri: Automatic Realtime Phishing Detection on Twitter

2.
Motivation: Some Statistics
• $520 million were lost worldwide from
phishing attacks in 2011 alone. (RSA Report)
• In 2012, around 20% of all phishing attacks
targeted Facebook
• Social network phishing has jumped 221%
attacks during Q1 of 2012
2

4.
What Did We Do to
Fill the Gap?
• Built a mechanism to Automatically detect
phishing on Twitter in Realtime
• No dependency on Blacklists
• Deployed end-user system for Twitter
users - Chrome Extension
4

13.
Features Used
• URL Features - Length, number of dots,
characters, redirections
• WHOIs Features - domain name,
ownership period
• Tweet Features - Number of #tags,
@mentions, length, trending topics
• Network Features - Follower/Followee
ratio, Age of account, Number of Tweets
13

15.
Evaluation
• Comparison with Blacklists
• 80.6% more phishing tweets detected by
PhishAri at zero hour which were caught by
blacklists after 3 days.
• Comparison with Twitter’s defense mechanism
• 84.6% more phishing tweets detected by
PhishAri at zero hour which were marked as
suspicious by Twitter after 3 days
15

18.
PhishAri: RESTful API
• Use above classiﬁcation model to create a
RESTful API
• POST requests can be made to API to query
a tweet
• Pre-trained classiﬁer model used for
classiﬁcation of new tweets
18

25.
Future Work
• Backend database for faster lookup
• Increase the scope of PhishAri from public to all
tweets
• Increase response time of PhishAri and
appearance of indicators
• Support for other browsers and mobile apps
25